[Authorization] Enforce policy in API admission and execution-time reauthorization #24

Activity

1. gnanirahulnutakki

   added this to the M1 — Control Plane Core milestone on Sep 1, 2026
2. gnanirahulnutakki

   added

   priority:p0Critical prerequisite or correctness boundaryCritical prerequisite or correctness boundary

   area:securityIdentity, authorization, isolation, credentials, and auditIdentity, authorization, isolation, credentials, and audit

   on Sep 1, 2026
3. gnanirahulnutakki

   added a parent issue on Sep 1, 2026

   • [Epic] Implement identity, policy, isolation, and audit #4
4. gnanirahulnutakki

   marked this as blocked by 2 issues on Sep 1, 2026

   • [Authorization] Define hierarchical roles, actions, and decision contracts #23
   • [API] Build the in-memory reference server and contract harness #21
5. gnanirahulnutakki

   added the

   Task

   issue type on Sep 1, 2026
6. gnanirahulnutakki

   marked this as blocking 6 issues on Sep 6, 2026

   • [Security Testing] Build the security-invariant and untrusted-input regression suite #28
   • [Planning] Implement deterministic, side-effect-free plans #33
   • [Execution] Implement idempotent execution, retries, rate limits, backpressure, and dead-letter handling #34
   • [Approvals] Implement plan-digest-bound review and approval policy #61
   • [Runtime Carryover] Integrate credential brokering with authoritative execution #87
   • [Runtime Carryover] Enforce durable audit and privileged administration #88
7. gnanirahulnutakki commented on Sep 12, 2026

   

   gnanirahulnutakki

   on Sep 12, 2026

   MemberAuthor

   More actions

   Acceptance clarification and implementation start

   Exact start state:

   • main, origin/main, raw remote main, and the GitHub ref all equal 480ea46efbead68295d1a16986d5500af237a4e6.
   • The worktree is clean.
   • Native blockers [API] Build the in-memory reference server and contract harness #21 and [Authorization] Define hierarchical roles, actions, and decision contracts #23 are closed.
   • No open PR or existing local/remote branch occupies gnanirahulnutakki/issue-24-runtime-authorization.
   • Protected main requires zero approvals from another person while retaining strict app-bound checks, administrator enforcement, conversation resolution, and force-push/deletion denial.

   Clarified executable acceptance:

   • Replace the reference harness's action-only allow-list at runtime with target-aware evaluation of the accepted veer.authorization.v1alpha1 PolicySet.
   • Resolve each retained resource or Operation from authoritative process-local state before evaluating it. Workspace lists use per-retained-row evaluation before pagination and disclosure.
   • Return a stable denial without invoking the mutation callback; add admission/revocation race tests proving denied or stale authority cannot mutate resource or Operation state.
   • Carry the exact authenticated actor and canonical decision into the existing immutable Plan contract, which binds actor fingerprint, policy version, and authorization-input digest.
   • Re-evaluate from current authoritative state before execution proof. Revocation, denial, or policy/input-version drift must fail closed before any provider-side-effect boundary.
   • Preserve ADR 0009: tenant policy cannot create a Workspace or replace resource status. The loopback harness may be pre-seeded deterministically for testing, but it will not invent platform bootstrap or controller authority.
   • Retain current request/body/idempotency/capacity bounds. No provider quota is applicable because this lane performs no provider execution; plan quota/cost evidence and durable enforcement remain with their dependency-ordered planning/execution issues.
   • Do not claim production OIDC, durable persistence, queue atomicity, audit durability, cross-process fencing, or provider execution.

   Required evidence remains ./hack/dev check, complete race and coverage gates, black-box allow/deny tests on a real listener, static/security/dependency scans, exact-head hosted checks, resolved review threads, and exact-main post-merge CI.

   Submitted on behalf of @ArdurAI. Contact: info@ardur.ai.
8. gnanirahulnutakki

   closed this as completedin #122on Sep 12, 2026